Add WSA runtime ksud check

Author: Ognisty321

docs/FAQ.md

@@ -27,7 +27,8 @@ Either reinstall the previous known-good Manager APK, or install a Manager build
 If the live self-test prints `/data/adb/ksud does not expose the kpm subcommand`, the running WSA userspace is still missing the KPM-capable `ksud`. Confirm it with:
 
 ```bash
-adb shell su -M -c "/data/adb/ksud --help 2>&1 | head -80"
+ADB="/mnt/d/Programy/Path Tools/adb.exe" ADB_TARGET=127.0.0.1:58526 \
+  bash scripts/wsa-check-runtime-ksud.sh
 ```
 
 The kernel cannot make the userspace `kpm` command appear. Install a Manager or `libksud.so` build that passes the x86_64 guard, then rerun `RUN_WSA=1 bash KernelSU/scripts/kpm-x86-preflight.sh`.

docs/WSA_COMPATIBILITY_MATRIX.md

@@ -6,7 +6,7 @@ WSA is now an archive-style target: Microsoft archived the public WSA app reposi
 
 | WSA package/build | Windows build | Kernel base | HVCI / Memory Integrity | Manager / libksud.so | KPM status | Notes |
 | --- | ---: | --- | --- | --- | --- | --- |
-| booted local WSA `2026-04-27` | `26200` | 5.15.104 | on | installed `/data/adb/ksud` lacks `kpm` subcommand | blocked-userspace | ADB connected to `127.0.0.1:58526`; `uname -a` reported kernel `#28` with `WSA-ReSukiSU+`; `KernelSU/scripts/kpm-x86-runtime-selftest.sh` now stops with a clear Manager/libksud mismatch before loading KPMs. |
+| booted local WSA `2026-04-27` | `26200` | 5.15.104 | on | installed `/data/adb/ksud` lacks `kpm` subcommand | blocked-userspace | ADB connected to `127.0.0.1:58526`; `uname -a` reported kernel `#28` with `WSA-ReSukiSU+`; `scripts/wsa-check-runtime-ksud.sh` and `KernelSU/scripts/kpm-x86-runtime-selftest.sh` stop with a clear Manager/libksud mismatch before loading KPMs. |
 | local main build `2026-04-27` | `26200` | 5.15.104 | on | release `ksud` SHA256 `68368b32b98adb6ffb2164c6551e0684c2d193e35fbde196384f4948b89573bf`, guard pass | build pass, live runtime pending | Kernel `#34`, SHA256 `c93249f528f515cc0d0cd2030e55791bf3c12bdc07a18748af645a4aefeeb50e`; sidecar manifest verifies the current WSA commit, ReSukiSU submodule, helper script hashes and artifact SHA; `scripts/kpm-x86-preflight.sh` passed without `RUN_WSA=1`. |
 | `MicrosoftCorporationII.WindowsSubsystemForAndroid_2407.40000.4.0_x64__8wekyb3d8bbwe` | `26200` | 5.15.104 | on | release `ksud` SHA256 `68368b32b98adb6ffb2164c6551e0684c2d193e35fbde196384f4948b89573bf` | pass | Validated locally with kernel `#30`, SHA256 `037b9507707bffca33c56cc421b5ff7085f8ec8b8f3d2abedb93072bdadfae46`, `scripts/kpm-x86-preflight.sh RUN_WSA=1` and `scripts/wsa-kpm-boot-smoke.sh`. |
 | 2407-style known-good local package | record exact package version | 5.15.104 | off | x86_64 KPM-capable ReSukiSU Manager | expected pass | Same package family as the validated HVCI-on row; validate separately before release claims. |
@@ -21,4 +21,5 @@ For each release candidate, add a row with:
 5. `adb shell su -c "ksud kpm doctor --json"`.
 6. `adb shell su -c "ksud kpm audit --json"` after a load/control/unload cycle.
 7. `KernelSU/scripts/check-manager-kpm-x86.sh` result for the Manager APK used in that row.
-8. If live validation is blocked before KPM load, record the exact `ksud` error and do not promote the row to `pass`.
+8. `scripts/wsa-check-runtime-ksud.sh` result.
+9. If live validation is blocked before KPM load, record the exact `ksud` error and do not promote the row to `pass`.

scripts/wsa-check-runtime-ksud.sh

@@ -0,0 +1,48 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ADB="${ADB:-adb}"
+ADB_TARGET="${ADB_TARGET:-127.0.0.1:58526}"
+KSUD="${KSUD:-/data/adb/ksud}"
+LOCAL_KSUD="${LOCAL_KSUD:-KernelSU/userspace/ksud/target/x86_64-linux-android/release/ksud}"
+
+log() {
+	printf '[wsa-ksud-check] %s\n' "$*"
+}
+
+adb_shell() {
+	"$ADB" -s "$ADB_TARGET" shell "$@"
+}
+
+adb_su() {
+	adb_shell "su -M -c \"$*\""
+}
+
+log "connecting to $ADB_TARGET"
+"$ADB" connect "$ADB_TARGET" >/dev/null || true
+"$ADB" -s "$ADB_TARGET" wait-for-device
+
+log "kernel"
+adb_shell uname -a
+
+if [ -f "$LOCAL_KSUD" ]; then
+	log "local release ksud"
+	sha256sum "$LOCAL_KSUD"
+	if [ -x KernelSU/scripts/check-manager-kpm-x86.sh ]; then
+		KernelSU/scripts/check-manager-kpm-x86.sh "$LOCAL_KSUD"
+	fi
+else
+	log "local release ksud not found: $LOCAL_KSUD"
+fi
+
+log "remote ksud path: $KSUD"
+if adb_su "$KSUD kpm --help" >/dev/null 2>&1; then
+	log "remote ksud exposes kpm"
+	adb_su "$KSUD kpm version" || true
+	adb_su "$KSUD kpm doctor --json" || true
+	exit 0
+fi
+
+log "remote ksud does not expose kpm"
+adb_su "$KSUD --help 2>&1 | head -80" || true
+exit 1